CVE-2026-106490: @backstage/plugin-techdocs-backend Improper Input Validation in TechDocs Static Content Requests
Summary
CVE-2026-106490: Backstage: Improper input validation in TechDocs static content requests. Affects @backstage/plugin-techdocs-backend versions < 2.2.4. Fixed in 2.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-techdocs-backend package is a component of the Backstage platform, designed to manage and serve documentation for software projects. It allows users to create, store, and retrieve technical documentation efficiently. However, this package has a vulnerability that can lead to unauthorized access to restricted content under certain conditions.
Vulnerability Detail
The vulnerability arises from improper input validation when using the Azure Blob Storage provider. An authenticated user may gain access to restricted TechDocs content if entity-level permissions are enabled. This issue is exacerbated in deployments that intentionally disable the default backend authentication policy, potentially exposing sensitive documentation to unauthorized users.
How To Fix
Latest published version: 2.4.0 as of 22 Oct 2026
npm install @backstage/plugin-techdocs-backend@2.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.4
This is the first release that contains the fix.
npm install @backstage/plugin-techdocs-backend@2.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the TechDocs backend to only those users who are permitted to view all stored documentation until you can apply the upgrade. Additionally, ensure that the default backend authentication policy remains enabled to minimize exposure.
Conclusion
The @backstage/plugin-techdocs-backend package has a vulnerability that can lead to unauthorized access to restricted documentation. It is crucial to update to the patched version 2.2.4 to mitigate this risk. Until then, implementing the suggested workarounds can help protect sensitive information.
See every vulnerability recorded for @backstage/plugin-techdocs-backend →
FAQ
The vulnerability is related to improper input validation, which may allow authenticated users to access restricted TechDocs content.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of risk.
Yes, the vulnerability has been patched in version 2.2.4 of the @backstage/plugin-techdocs-backend package.
If an immediate upgrade is not possible, restrict access to the TechDocs backend and keep the default backend authentication policy enabled as a workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/plugin-techdocs-backend.
